All issues

Search results

Stored Path Traversal in jshERP via aliOss_linkUrl

Status: Open.

#159 In jishenghua/jshERP;

· AnalogyC0de opened on Jul 2, 2026

[Security] jshERP Role Button Permission BOLA / Privilege Escalation

Status: Open.

#158 In jishenghua/jshERP;

· cvecommit-byte opened on Jun 24, 2026

[Security] jshERP <= 3.6 Plugin Installation Leads to Remote Code Execution

Status: Open.

#156 In jishenghua/jshERP;

· wenfenhui opened on Jun 3, 2026

[security] Stored SSRF in jshERP-boot

Status: Open.

#155 In jishenghua/jshERP;

· AnalogyC0de opened on May 19, 2026

[Security] Stored Path Traversal in jshERP

Status: Open.

#154 In jishenghua/jshERP;

· AnalogyC0de opened on May 19, 2026

jshERP vertical privilege escalation via missing authorization in UserBusiness permission relationship APIs

Status: Open.

#153 In jishenghua/jshERP;

· LinYuanyi1 opened on Apr 25, 2026

[CVE Request] Admin-to-SSRF via PlatformConfig Modification

Status: Open.

#152 In jishenghua/jshERP;

· AnalogyC0de opened on Apr 23, 2026

[CVE Request] Cross-Tenant Role Ownership Drift via /role/update (tenant_id writable in SET clause)

Status: Open.

#151 In jishenghua/jshERP;

· SeTG-git opened on Mar 17, 2026

启动失败：platformConfigService 与 userService 双向注入导致 BeanCurrentlyInCreationException

Status: Open.

#150 In jishenghua/jshERP;

· Royikiss opened on Feb 27, 2026

Path traversal causes information leakage in PluginController

Status: Open.

#147 In jishenghua/jshERP;

· mukyuuhate opened on Jan 16, 2026

Path traversal Vulnerability in PluginController

Status: Open.

#146 In jishenghua/jshERP;

· mukyuuhate opened on Jan 15, 2026

There is an SQL injection vulnerability in the application

Status: Open.

#145 In jishenghua/jshERP;

· mukyuuhate opened on Jan 15, 2026